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IN THE CLAIMS 

1 . (Currently amended) A method for identifying a computer virus in interpreted 

language source code using a virus scan engine, the method comprising: 
receiving a portion of intejpreted language source code; 

generating a language-independent representation of the portion of the interpreted 
language source code; 

comparing the language^independent representation with a virus si^atur e in a pattern 

m3£Stlgi;and 

detennining if the language-independent representation matches the virus signature, 
whereby a match indicates a computer virus has been identified. 



2. (Original) The method of claim I , wherein the interpreted language source 
code is a scripting language source code. 
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3. (Original) The method of claim 1 , wherein the virus signature is a language- ^ 

independent representation of an interpreted language source code computer virus. £^ 
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4. (Original) The method of claim 1 , wherein the portion of interpreted language- 
source code and the virus signature are represented as a linearized string of key actions. 
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5. (Cuir^ntly amended) A method for generating a virus signature using a virus 
scan engine , the method comprising: 

receiving a portion of interpreted language source code containing a compiuer virus; 
generating a language-independent representation of the computer virus using a 
threadizor : and 

storing the language-independent representation of tlie computer virus as a virus 
signamre. 

6. (Original) The method of claim 5, wherein the interpreted language source 
code is a scripting language source code. 



7. (Original) The method of claim 5, wherein the virus signature is compiled in 

binary format. ^ 
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8. (Currently amended) The method of claim 5» wherein the language independent ^ 
representation is a linearized string of key actions produced using a threadiaor . ^ 

m 

9. (Original) The method of claim 5, wherein the virus signature includes input 'ITB 
fipom a virus analyst. O 

o 
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10. (Currently amended) The method of claim 5, further comprising: 

parsing the portion of interpreted language source code into tokens using a parser : and 
generating the language-independent representation of the computer virus using at least a 
portion of the tokens. 
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1 1 . (Currently amended) A method for identifying a virus in interpreted language 

souTx;e code using a virus scan engine , the method comprising: 
receiving a portion of interpreted language source code; 

parsing the portion of the interpreted language source code into tokens to generate a 
tokenized source code using a parser, wherein at least some of the tokens represent key actions; 
extracting selected key actions from the tokenized source code, 
linearizing the key actions to generate an executing thread; 

comparing the execviting thread with a virus signature of a known virus in a pattern 
matcher : and 

deterjuining whether the executing thread matches the virus signature. 



12. (Original) The method of claim 1 1 , further comprising: 
oatputting the identification of the known virus. 
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1 3 . (Ori ginal) Tlie method of claim 1 1 » wherein the portion of the interpreted ^ 
language source code is lexically parsed, j> 

14. (Original) The method of claim 11, wherein the portion of the interpreted (XJ 
language source code is lexically and grammatically parsed. ^ ITI 

o 



1 t 
PAGE 6/1 1 ' RCVD AT 1 1/2212005 3:33:48 PM [Eastern standard Time] ' SVRiUSPTOiFM^^^ 



NOV-22-2005 14:36 F ROM-BEYER WEAVER THOMAS 612-825-6304 T-868 P. 007/011 F-644 

I 

15. (Qirrpntly amended) A method using a virus scan engine for generating a virus 
signature from a portion of interpreted language source code including a computer virus, the 
method comprising: 

receiving a portion of interpreted language source code containing a computer virus; 
parsing the portion of the interpreted language source code containing the computer vims 

Into tokens to generate tokcnized source code using a parser, wherein at least some of the tokens 

represent key actions; 

extracjting key actions from the tokenized source code, 

linearizing the key actions to generate an executing thread using a threadi^or : 

detenpining the set of minimum key actions in die executing thread required to effect the 

computer virus; and 

storing the set of minimum key actions as a virus signature. 

16. (Original) The method of claim 15, further comprising: 
compiling the virus signature in binary format. 

I 

17. (Original) The method of claim 1 5, further comprising: 
compiling the virus signature with data ii^ut by a virus analyst; and 
storing the virus signature as part of a virus pattern file. 

1 8. (Original) Tlie method of claim 17, wherein the virus pattern file fiirther 
includes a dictionary of key actions. 

1 9. (Original) The method of claim 15, wherein the portion of the interpreted 
language source code is lexically parsed. 

20. (Original) The method of claim 15, wherein the portion of the intctpreted 
language source code is lexically and grammatically parsed. 
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21 . (Currently amended) A computer readable medium containing program code for 
identifying a computer virus in inieipreted language source code using a virus scan engine ^ the 
computer readable medium comprising instructions for: 

receiving a portion of interpreted language source code; 

parsing the ponion of the interpreted language source code into tokens to generate a 
tokenized source code usin^ a parser, wherein at least some of the tokens represent key actions; 

linearizing at least a portion of the key actions to generate an executing thread; 

comparing the executing thread with a vims signature of a known computer virus jna 
pattern matcher ; and 

determining whether the executing thread matches the virus signature, 

22. (Original) The computer readable medium of claim 2 1 , further comprising: 
outputting the identification of the known computer virus. 



23 . (Original) The computer readable medium of claim 2 1 , wherein the ponion of 
the interpreted language source code is lexically parsed. 

24. (Ori ginal) The computer readable medium of claim 2 1 , wherein the portion o^ | 
the interpreted language source code is lexically and grammatically parsed. ^ ^ 
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25, (Currently amended) A computer readable medium containing program code 

using a virus scan engine for generating a virus signature &om a portion of interpreted language 
source code including a computer virus, the computer readable medium comprising instructions 
for: 

receiving a portion of interpreted language source code containing a computer vims; 

parsing the portion of the interpreted language soinrce code containing the computer virus 
into tokens to generate tokenized source code using a parser , wherein at least some of the tokens 
represent key actions; 

linearizing at least a portion of the key actions to generate an executing thread using a 
threadizor ; 

deterinining the set of minimuni key actions in the executing thread required to effect the 

i 

computer virus; and 

5tori^g the set of minimum key actions as a virus signature. 
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26. (Original) The computer readable medium of claim 25» further comprising: ||S 



compiling the virus signature in binary format. 
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27. (Original) The computer readable medium of claim 25, further comprising: ]^ 
compiling the virus signature Mdth data ii^ut by a virus analyst; and ^ 
storing the virus signature as part of a virus paitem file. |X) 
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28, (Original) The computer readable medium of claim 27, wherein the virus ^ 
pattern file further includes a dictionary of key actions. 



29. (Original) The computer readable medium of claim 25, wherein the portion of 
the interpreted language source code is lexically parsed. 

30. (Original) The computer readable medium of claim 25, wherein the portion of 
the interpreted language source code is lexically and grammatically parsed. 
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